NDAA pushes U.S. Cyber Command to be more aggressive

The Senate's version of the annual defense policy bill sets a road map for how U.S. Cyber Command will ramp up operations.

By the Senate Armed Services Committee’s estimation, the United States has held back in cyberspace.

The committee is angling to change that with the latest National Defense Authorization Act, proposing to free up the military on the front lines of cyber conflict, create a new strategic cyber entity and respond to Russian aggressions in-kind.

The bill’s authors wrote that lawmakers have long-standing concerns about the lack of an effective U.S. strategy to deter and counter cyber threats. To counter foreign state actors bent on stealing, striking, spying or disrupting in cyberspace, the bill suggests boosting resilience, increasing attribution capabilities, emphasizing defense and enhancing the country’s ability to respond to attacks.

“We’re letting episodes define strategy. It should be the other way around, where we clearly articulate our cyber deterrence strategy and rules of engagement,” said Frank Cilluffo, director of George Washington University’s Center for Cyber and Homeland Security.

By offering a road map for the U.S. Cyber Command, signaling when U.S. cyber forces will go on attack and directing the United States to employ all instruments of national power, “this bill gives [CYBERCOM] its marching orders going forward,” Cilluffo said.

According to the proposed law, cyber incidents that inflict casualties, undermine democratic society, damage critical infrastructure or affect armed forces could trigger U.S. offensive cyber operations.

The norm-setting bill directs CYBERCOM to take the fight to an adversary on foreign turf. If an actor using the networks or infrastructure of a third-party country stages an attack on the America or an ally, the bill suggests that the U.S. military can respond without the host government’s permission.

Though the law greatly expands who and what U.S. forces are authorized to target, the U.S. is “not going to be able to go in and attack willy-nilly in large amounts without any consequences,” said Megan Reiss, a senior fellow at the R-Street Institute. “This basically just clarifies that the U.S. reserves the right to deal with networks in third-party countries, especially in the case that those countries are unable or unwilling to deal with the offending networks.”

This provision is significant, because it is the first time this concept – cyber countermeasures in a third-party country – has been publicly acknowledged and codified by the U.S. government. The language is also noteworthy because it suggests that the U.S. government is warming to the idea of “hacking back.”

The defense proposal also calls for the establishment of a “Cyberspace Solarium Commission,” “tasked with developing a strategic approach to protecting and advancing the United States’ advantage in cyberspace.” The commission, named after a similar entity created for the nuclear domain by the Eisenhower administration in the 1950s, would draw from experts across the government.

Sen. Ben Sasse, R-Neb., who authored the proposal for the commission, said in a press release: “The United States does not have a serious cyber strategy but our enemies do…We lack a doctrine that defines how, when, and where we play offense and defense. We don’t have a playbook. It’s time to draft one.”

The commission will convene experts from the cyber, defense and regional communities.

“Rarely do they come together,” Cilluffo said. “To do cyber right, you have to have all three.”

The bill bluntly tackles cyber and information threats stemming from Moscow, directing CYBERCOM to “take appropriate and proportional action” in cyberspace to “disrupt, defeat and deter” Russian cyberattacks.

“Basically they’re saying: ‘we know Russia is doing this, so let’s make sure Cyber Command has the authority to deal with it when they see ongoing attacks,” said Reiss.

The efforts to boost U.S. Cyber Command come as leadership has undergone a change. Gen. Paul Nakasone has recently assumed command of the unit after previously running U.S. Army Cyber Command.

Open-source security is posing challenges governments can’t easily solve

A diffuse landscape, fruitful targets, companies not stepping up, AI’s influence and flagging U.S. government efforts all figure into a shifting threat.

Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn

Former NSA chiefs worry American offensive edge in cybersecurity is slipping

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure